TA2541

Overview

TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.

Naming & attribution

It uses 28 documented ATT&CK techniques — more than 62% of the 174 groups tracked here. Activity attributed since at least 2017.

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• APT-C-36 — 18 shared techniques (38% overlap)
• LazyScripter — 13 shared techniques (37% overlap)
• Confucius — 11 shared techniques (31% overlap)
• Gamaredon Group Russia — 22 shared techniques (29% overlap)
• TA505 — 14 shared techniques (29% overlap)
• Sidewinder India — 13 shared techniques (29% overlap)

Capabilities

• Custom malware/implant development — ATT&CK: 7 attributed custom malware families

TTPs — 28 techniques across 8 tactics

Tools & malware (9)

Snip3 · Revenge RAT · jRAT · WarzoneRAT · Imminent Monitor · AsyncRAT · NETWIRE · Agent Tesla · njRAT

Reporting (2)

• Charting TA2541's Flight — Larson, S. and Wise, J
• Operation Layover: How we tracked an attack on the aviation industry to five years of compromise — Ventura, V